[RKinner]

If you want to format it I guess it won't hurt just make sure that it doesn't pick up an MBR in the process.

[Advertisements]

 

I opened disk management and it said "initialize" or something of that nature, clicked GPT. Now this is what I see.

 

Good to go?

 

And "AOMEI backupper standard" that is the correct cloning software?

Edited by Established301, 09 October 2016 - 04:56 PM.

[Established301]

 

I opened disk management and it said "initialize" or something of that nature, clicked GPT. Now this is what I see.

 

Good to go?

 

And "AOMEI backupper standard" that is the correct cloning software?

Edited by Established301, 09 October 2016 - 04:56 PM.

[RKinner]

Looks good and you do have the correct AOMEI.

 

If I remember correctly with AOMEI you may need to check on it periodically while it clones.  I think it will stop if it finds a bad sector then you need to tell it to Skip.

[Established301]

OK will update. And under settings, "copy without resizing partitions" is selected. Is that right?

[RKinner]

Yes.  Since both drives are the same size there is no need to change the partitions.

[Established301]

It worked!  I want to thank you for all the help RKinner. Really appreciate it.

[Established301]

[RKinner]

Great.  Run a disk check and a defrag to make sure everything is OK.

[Established301]

Gotcha. As a side note, you have any idea what these are?  

 

 

Edit: Checked and all is well.

 

 

Edited by Established301, 10 October 2016 - 12:20 AM.

[RKinner]

PBR Image drive and WINRETOOLS drive are the recovery partitions and contain the recovery image (PBR Image) and Windows Recovery Environment tools (WINRETOOLS) used by Dell. Apparently they became visible with Win 10.  I expect they would take your system back to how it was when it came from the factory.  

 

Not enough info to tell you what the last one was.

Copy the foloowing:

 

reg query HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices /s > \junk.txt
notepad \junk.txt

Open an elevated command prompt:

 

http://www.howtogeek...-in-windows-10/

 

If you open an elevated command prompt it will by default open in c:\Windows\system32

 

Once you have an elevated command prompt:

 

Right click and Paste (or Edit then Paste) and the copied text should appear.  Hit Enter if notepad does not open.  Copy and paste the text from notepad to a reply.

 

 

[Established301]

 

PBR Image drive and WINRETOOLS drive are the recovery partitions and contain the recovery image (PBR Image) and Windows Recovery Environment tools (WINRETOOLS) used by Dell. Apparently they became visible with Win 10.  I expect they would take your system back to how it was when it came from the factory.  

 

Not enough info to tell you what the last one was.

Copy the foloowing:

 

reg query HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices /s > \junk.txt
notepad \junk.txt

Open an elevated command prompt:

 

http://www.howtogeek...-in-windows-10/

 

If you open an elevated command prompt it will by default open in c:\Windows\system32

 

Once you have an elevated command prompt:

 

Right click and Paste (or Edit then Paste) and the copied text should appear.  Hit Enter if notepad does not open.  Copy and paste the text from notepad to a reply.

 

 

 

 

HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices

    \??\Volume{c1e3b100-6e69-11e6-8275-e0db55c52c54}    REG_BINARY    5C003F003F005C00530043005300490023004300640052006F006D002600560065006E005F004D007300660074002600500072006F0064005F005600690072007400750061006C005F004400560044002D0052004F004D002300320026003100660034006100640066006600650026003000260030003000300030003000310023007B00350033006600350036003300300064002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D00

    \??\Volume{c1e3b126-6e69-11e6-8275-e0db55c52c54}    REG_BINARY    5C003F003F005C00530043005300490023004300640052006F006D002600560065006E005F004D007300660074002600500072006F0064005F005600690072007400750061006C005F004400560044002D0052004F004D002300320026003100660034006100640066006600650026003000260030003000300030003000320023007B00350033006600350036003300300064002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D00

    \??\Volume{c1e3b174-6e69-11e6-8275-e0db55c52c54}    REG_BINARY    5F003F003F005F00550053004200530054004F00520023004400690073006B002600560065006E005F00530061006E004400690073006B002600500072006F0064005F004300720075007A00650072005F004400690061006C0026005200650076005F0031002E00320037002300340043003500330031003000300031003400340030003500320038003100310037003000390031002600300023007B00350033006600350036003300300037002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D00

    \??\Volume{cc46c1dc-ce63-11e5-8252-fcf8aebfe90f}    REG_BINARY    5F003F003F005F00550053004200530054004F00520023004400690073006B002600560065006E005F0053006F006E0079002600500072006F0064005F004D004800530026005200650076005F0031002E003000300023003100310061006600370030003100610063006400330064002600300023007B00350033006600350036003300300037002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D00

    \??\Volume{cc46c1dd-ce63-11e5-8252-fcf8aebfe90f}    REG_BINARY    5F003F003F005F00550053004200530054004F00520023004400690073006B002600560065006E005F0053006F006E0079002600500072006F0064005F004D004800530026005200650076005F0031002E003000300023003100310061006600370030003100610063006400330064002600310023007B00350033006600350036003300300037002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D00

    \??\Volume{d4d4b5b7-9de7-11e3-824b-806e6f6e6963}    REG_BINARY    5C003F003F005C00530043005300490023004300640052006F006D002600560065006E005F004D0041005400530048004900540041002600500072006F0064005F004400560044002B002D00520057005F0055004A003800450032002300340026003200390066003800370037003300340026003000260030003100300030003000300023007B00350033006600350036003300300064002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D00

    \DosDevices\C:    REG_BINARY    444D494F3A49443A05B957DF4BE7084185F6A304EE4E1D1D

    \DosDevices\D:    REG_BINARY    5C003F003F005C00530043005300490023004300640052006F006D002600560065006E005F004D0041005400530048004900540041002600500072006F0064005F004400560044002B002D00520057005F0055004A003800450032002300340026003200390066003800370037003300340026003000260030003100300030003000300023007B00350033006600350036003300300064002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D00

    \DosDevices\G:    REG_BINARY    444D494F3A49443AF58FEAD8BA02D64FA9E46A50F8645791

    #{5feeaad5-851f-11e6-a33b-e0db55c52c54}    REG_BINARY    444D494F3A49443A55ACCAFD58E9864D8467779E99FA1787

    \??\Volume{07d5b34b-87ae-11e6-827d-e0db55c52c54}    REG_BINARY    5F003F003F005F00550053004200530054004F00520023004400690073006B002600560065006E005F00410053004D0054002600500072006F0064005F00320031003100350026005200650076005F00300023003100320033003400350036003700380041003100310044002600300023007B00350033006600350036003300300037002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D00

    \DosDevices\F:    REG_BINARY    444D494F3A49443AA42670AACF1D1142A72DFE860255F2B2

    \DosDevices\H:    REG_BINARY    444D494F3A49443AFB53225C7DE05449A64F810635A920DD

[RKinner]

No sign of it in the registry.  I wonder if it's a leftover from a zero access infection?  There used to be one that installed its own partition then modified the mbr to boot from it.

 

See if TDSSKiller will run on your OS.

 

http://support.kaspe...lity#TDSSKiller

 

I'd download the exe version.

 

Save it to your desktop then run it by right clicking and Run As Admin.

 

 

If TDSSKiller alerts you that the system needs to reboot, please consent.

 

Run TDSSKiller again but this time:

before you hit the Scan  hit  Change Parameters and check the two items under Additional Options. OK then Scan.

In this mode it is prone to false positives so do not change the SKIP option to DELETE unless it says TDSS.

When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.

[Established301]

Working on my reply but this dialog box is annoying me, I digress: do you what the deal is with this? it wont go away. And I never seen it before http://imgur.com/m0RTO9m

 

[Established301]

OK so download the program and run a scan. Then reboot. Then run it again. ? I understand the rest of instructions but just asking how many scans you meant for me to run.

 

Disregard previous post, got the dialog removed in windows processes. 

Edited by Established301, 12 October 2016 - 01:37 AM.

[RKinner]

Total of two scans for now.  They shouldn't take too long.